xpertrat | e4324629a9700691321d6212152a1c2080bc3422bda11c8173633744c753a122 | Triage

Submit
Reports

Overview

overview

Static

static

95aa92ec03...6d.exe

windows7_x64

95aa92ec03...6d.exe

windows10_x64

Sharing

General

Target

95aa92ec032cf7b52020f9174c77e66d
Size

1.8MB
Sample

201117-kbwfy5e14e
MD5

95aa92ec032cf7b52020f9174c77e66d
SHA1

b4b15beb08b310b451ccd8374f94fe817b2c28e5
SHA256

e4324629a9700691321d6212152a1c2080bc3422bda11c8173633744c753a122
SHA512

ca8e6e16375853698bdddf482c6937b99e6262baa7d4334bb9b2fe100d5a5409bd726a421a56d5dee764a8da0509a8a8421d6f3603d8a8d228a64eff400b3dab

Score

10^/10

xpertrat test evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

95aa92ec032cf7b52020f9174c77e66d.exe

Resource

win7v20201028

xpertrat test evasion persistence rat trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

95aa92ec032cf7b52020f9174c77e66d.exe

Resource

win10v20201028

xpertrat test evasion persistence rat trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

79.134.225.47:4576

79.134.225.47:7583

Mutex

W6H110R7-B3E0-O883-U8A8-D2B5N7M7S4B1

Targets

- Target
  
  95aa92ec032cf7b52020f9174c77e66d
- Size
  
  1.8MB
- MD5
  
  95aa92ec032cf7b52020f9174c77e66d
- SHA1
  
  b4b15beb08b310b451ccd8374f94fe817b2c28e5
- SHA256
  
  e4324629a9700691321d6212152a1c2080bc3422bda11c8173633744c753a122
- SHA512
  
  ca8e6e16375853698bdddf482c6937b99e6262baa7d4334bb9b2fe100d5a5409bd726a421a56d5dee764a8da0509a8a8421d6f3603d8a8d228a64eff400b3dab
Score

10^/10

xpertrat test evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- XpertRAT Core Payload
- Adds policy Run key to start application
  persistence
- Deletes itself
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertrattestevasionpersistencerattrojan

behavioral2

xpertrattestevasionpersistencerattrojan

© 2018-2024

Terms | Privacy